greymd / teip

Masking tape to help commands "do one thing well"
MIT License
571 stars 19 forks source link

atty potential unalined read #67

Open greymd opened 10 months ago

greymd commented 10 months ago

This bug is created from a dependabot alert Screenshot 2024-01-02 at 19 28 43

Following crates are using atty internally.

$ cargo tree | grep -C 5 atty
teip v2.3.0 ..
├── cfg-if v0.1.10
├── env_logger v0.7.1
│   ├── atty v0.2.14
│   │   └── libc v0.2.139
│   ├── humantime v1.3.0
│   │   └── quick-error v1.2.3
│   ├── log v0.4.17
│   │   └── cfg-if v1.0.0
--
│           ├── quote v1.0.23 (*)
│           └── unicode-ident v1.0.6
└── structopt v0.3.26
    ├── clap v2.34.0
    │   ├── ansi_term v0.12.1
    │   ├── atty v0.2.14 (*)
    │   ├── bitflags v1.3.2
    │   ├── strsim v0.8.0
    │   ├── textwrap v0.11.0
    │   │   └── unicode-width v0.1.10
    │   ├── unicode-width v0.1.10
--
│   │   ├── predicates-core v1.0.5
│   │   └── termtree v0.4.0
│   └── wait-timeout v0.2.0
│       └── libc v0.2.139
└── criterion v0.3.6
    ├── atty v0.2.14 (*)
    ├── cast v0.3.0
    ├── clap v2.34.0 (*)
    ├── criterion-plot v0.4.5
    │   ├── cast v0.3.0
    │   └── itertools v0.10.5 (*)

I will try to upgrade those crates and see if this alert is gone or not.

greymd commented 10 months ago

structopt is in maintainance mode. We need to replace it to clap to remove atty. https://github.com/TeXitoi/structopt